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LABELS AND DISCLOSURE 
by Esther Dyson 


A common misperception about the Internet is that it’s a homogeneous en- 
vironment. Everything in it is accessible to everyone; there are no bound- 
aries. It’s all a cesspool of anarchists, terrorists, dope fiends, dirty 
pictures that can reach out and snatch unwary children... It’s also a 
hotbed of fraud and insecurity. It has no central control, and people can 
vanish into it, safe from law-enforcement. That's why we need strong 
government oversight and some universal laws to make it a safe place. 


In fact, all the above is misguided. The Internet is not a homogeneous 
place -- and as a medium that will support millions and even billions of 
individuals and organizations, it shouldn’t be. Diverse already, it will 
only become even more variegated and local as it gets built up and civi- 
lized. In this and the forthcoming February issue of Release 1.0, we out- 
line how it’s likely to happen -- and offer encouragement for the mechan- 
isms that will foster this progress. 


The Net is already full of boundaries -- everything from domain names and 
passwords to language barriers and payment requirements (see Release 1.0, 
June 1996). Moreover, even things that are accessible must usually be 
downloaded or visited. Yes, you can be part of discussion groups, whether 
through mailing lists, Websites or chats -- some restricted, some open to 
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States to Russia (where the Duma held hearings on "the future of the Inter- 
net" on December 17), are trying to regulate the Net and people's behavior 
on it. The World Intellectual Property Organization just concluded a meet- 
ing in Geneva trying to promulgate new, restrictive laws to handle copy- 
right protection on the Internet. The European Commission is asking local 
governments to foster self-regulation -- or else. Countries such as France 
and Russia restrict and monitor the use of encryption, and others restrict 
international traffic into and out of their territories. 


Many people would prefer to see traditional government stay out: "We can 
handle our own problems, thank you!" 


Well, we do need governance on the Net; we just don’t need the kind of gov- 
ernance we're likely to get if we don’t take action for ourselves. Many 
libertarians would like absolute freedom, but that doesn’t work in real 
life and it won't work on the Net. Not all people are inherently good or 
even well-behaved, and they can make it pretty miserable for the rest of 
us. Precisely because the Internet empowers individuals to exercise their 
own rights, it increases their power to infringe on the rights of others. 


So we must consider how governance is to be applied. Certainly the terri- 
tory shouldn’t be handed over to a single government. But if you give it 
to several governments you will create conflicts, since the Net's borders 
don’t coincide with those of any terrestrial regime. 


Just do it? 


Meanwhile, self-regulation can solve many problems...and has the advantage 
that you don’t need to wait for any government action or large-scale agree- 
ments (although frequently the threat of government action hastens such ef- 
forts). All you have to do is get a bunch of people together and do it! 


This issue of Release 1.0 and the issue planned for February describe 
several groups that are just doing it! Overall, we attempt to define how 
the Net can be governed in three specific areas -- content selection/ 
control in this issue, privacy and security in the February issue -- ina 
way that allows maximum choice to individuals while protecting the rights 
of other individuals. Such a happy outcome is not possible in all areas, 
to be sure. But in these three areas you can use market mechanisms rather 
than one-size-fits-all regulation to achieve not just the best set of rules 
for the majority, but different sets of rules that people can pick for 
themselves, whether going to a community or simply visiting a site. 


In a sense, we're talking about creating virtual governments (or self- 
regulating communities) that people can select for themselves, according to 
which rules they want to live by in a particular context. That is, you can 
use one group’s rule-set for privacy, and another for content selection. 
Underlying those- different rule-sets, we do still need a more general set 
of rules -- and dispute-resolution mechanisms -- that govern the dis- 
closure, acceptance and observance of all rule-sets. 


Communities can set their own rules as long as they are clear 
about what the rules are. 


Release 1.0 24 December 1996 


These rule-sets -- whether they govern use of language, privacy principles 
or security standards -- have great moral authority precisely because the 
people they affect are there by free choice. They are not chafing under 
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rules imposed by some government they may have voted against (or voted for 
reluctantly because the rules came as a package deal and they had to take 
the bad with the good). 


Don’t regulate; annotate! 


Many people believe that the best way to control behavior is through laws 
and enforcement mechanisms. The laws can be implemented as specific 
regulations, which in turn can be interpreted by a court if necessary. 
That's pretty much how we do it in the US, in all too many cases. Certain 


things are best handled by law -- murder, for example. But for many pur- 
poses, laws are inflexible, and regulations are often even worse. For most 
things other than murder, it’s hard to get worldwide agreement -- and even 


about murder there are different concepts of extenuating circumstances. 


In a large number of areas of human activity, individual tastes legitimate- 
ly vary. Some people find certain language offensive; others find it 
refreshing. Some like to maintain their privacy; others are happy to share 
their secrets with the world. Some like religious imagery; others find it 
offensive. Some expect to have others look out for their welfare; others 
reject paternalism. Some like risky investments such as Netscape and 
Yahoo!; others prefer the safety(?) of AT&T and IBM. In the world at 
large, we often have to live with others’ preferences: no Christmas trees 
in the town square during the holidays, but secular advertisements all over 
the place. Loud and boring talkers next to us on an airplane. Pretentious 
statues on neighbors’ lawns. 


In the online world, it’s easier to find congenial neighbors, to join con- 
versations that suit your tastes, and so on. You can do so without in- 
flicting your preferences on your neighbors. Now you no longer have to 
take your privacy regulations along with your content controls; you can 
select different regimes for each. The trick is labels and disclosure. 


Ideally, a person can use these labels to pick things, or instruct a brow- 
ser where to take him or what to avoid automatically. And ideally, they 
would work perfectly. Adults could always get what they want and could 
control what their kids see. The truth is, the filters can be bypassed by 
extremely clever kids, but overall they create a more secure environment 
and deal with the problems of parental content control better and in a 
freer way than any government ever could. 
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LABELING CONTENT 
So how does this actually work for content? 


Well-meaning people’s first reaction to problems with offensive content is 
often that the government should control it, so that children aren’t ex- 
posed to filth, people can’t print lies, terrorists can’t find bomb-making 
instructions, invalids can’t be led astray by quacks. Someone must set 
standards! In some countries, governments want to limit the proportion of 
foreign (or foreign-language) material, liquor advertising, or what China 
memorably calls “harmful material" -- as in “harmful to the Chinese govern- 
ment." You may or may not think any of these goals are legitimate, but how 
are they to be achieved? 


The answer is to label the content, and then allow people to make their own 
choices. The technical issue is how these labels should work. For exam- 

ple, do we want something like the Annual Percentage Rate that specifies a 

particular way to present a limited range of information? 


That doesn’t make sense in terms of rating content -- even though Hollywood 
handles movies this way, and the US broadcasting industry is trying to en- 
force a similar system for television...and who knows what else? The one- 
rating-fits-all-varieties system may not technically be government control, 
but it comes too close to central control to operate much differently in 
practice. 


In fact, there are many different ways to rate, say, sexual material, and 
many different preferences/aversions among consumers and parents. It makes 
more sense for various groups to have their own standards for content, from 
age-based ranges to religious issues, violence meters, and the like. 


What is needed is a broad technical standard for presenting each group’s 
assessments, in a way that lets software as well as people know where to 
find the label and how to read it. It’s the equivalent of a packaging 
standard specifying the location, type size and structure of a label, 
without requiring it to be in ounces or grams -- or even requiring it to 
include weight at all. The consumer can decide what he wants to know. 
Ideally, there should be a standard form of attribution as well, so that 
you can search for labels from a rater you trust, and some means of 
authentication of rater, product rated and the rating. Optionally, of 
course. Anyone could rate something anonymously -- and anyone else could 
decide whether to pay attention to such unsourced ratings. 


In fact, such a standard has just emerged -- the Platform for Internet Con- 
tent Selection. Earlier this month the World Wide Web Consortium (W3C), 


l1 Or governments may mandate the choices, not an approach we like, but one 
that is eminently possible and even likely in some places. Government con- 
trol of content is inherently coercive -- and not usually totally effec- 
tive, thank goodness! Yet people in the US tend to forget that governments 
can shoot people or lock them up, so that what is technically possible may 
still be practically dangerous. Seeing your neighbor dragged away at mid- 
night has a deterrent effect. More on this in the future. 
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the people who define most standards for the Web, announced PICS as a for- 
mal standard. 


Platform for Internet Content Selection (PICS) 


The PICS effort began in the summer of 1995; the Communications Decency Act 
was in the air, but not yet passed. A variety of groups including the 
Electronic Frontier Foundation? and the Center for Democracy and Technol- 
ogy, and many companies and people felt there just had to be a better way 
than government regulation of content. In August 1995 they convened a 
meeting under the auspices of the W3C. Their goal was to define a technol- 
ogy platform (like the Web itself) on top of which people could define 
their own content. PICS is a set of Web-oriented protocols for how ratings 
can be expressed, distributed and parsed, not a rating system in itself. 


"We already had a technical agenda at W3C," says Paul Resnick, a researcher 
at AT&T Labs who is also chairman of the PICS Steering Committee. "We were 
already thinking about metadata and annotations, and we leveraged the poli- 
tical agenda to get it through." Although the original impetus came for 
rating content for suitability for children, many of the participants see 
it as far more extensible than that. 


Now, many meetings and much work later, PICS implementations should start 
proliferating. The W3C seal of approval -- ratified by the Consortium’s 
160-plus corporate members -- gives the standard broad credibility. (Not 
all members voted, but all who voted approved the standard. The W3C won't 
give further details, notes Resnick, "but you can say that we did better 
than the US elections.") 


PICS, then, is a technical standard for labels. It allows any PICS-enabled 
browser or other tool to find and interpret the label on any piece of con- 
tent or Website. Furthermore, anyone can publish his own label for any URL 
for interpretation by other PICS tools. And vice versa: A user can specify 
not just which ratings but which rating service he wants to trust. Of 
course, not every page is going to carry the ratings for all the different 
services; widely-rated sites would soon get overloaded. Just as in other 
markets, some rating services will be more widely consulted than others. 


Service bureaus will maintain electronically readable lists of labels not 
posted on the sites themselves. Thus you can go to, say, the Sunny Valley 
site and find everything selected by the PTA for kids 8 to 10 (assuming 
there is proper support for such searches, and not just filtering). You 
can also, with slightly more sophisticated software, have your browser con- 
sult several services: "I want only sites rated 'A’ by the Catholic 
Church; 'D2' by Healthy Living; and ‘suitable for 9 and up’ by the Sunny 
Valley PTA." 


The system has its imperfections, but it is becoming relatively simple for 


both self-raters and parents to use as appropriate tools are developed. 
Parents can set their own desired level of the various factors, rather than 


2 Speaking of disclosure: Esther Dyson is chairman of the Electronic 
Frontier Foundation. 
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relying on a simple age scale like that of the Motion Picture Association 
of America’s, (Juan's eight-year-old may be more mature than Alice's ten- 
year-old; only Juan and Alice know for sure. And Juan may care most about 
sexual content, while Alice deplores violence.) 


The wonderful thing is that this approach can do more than just protect 
children. For example, it can allow an adult to find articles rated "in- 
sightful" by their favorite critic; all recipes rated spicy by Julia Child, 
or all sites rated “pure French" by the French government. It could also 
be part of a requirement by the French government that all browsers used in 
France measure the user's time spent viewing French and non-French content, 
sending the user a warning when the proportion of non-French content is too 
high. Sound ridiculous? Maybe. But the technology is capable of doing 
both clever and outrageous things. 


How it works 


We won't go into great technical detail here, but... The PICS labels fol- 
low a defined syntax. They can be embedded in a site’s HTML, or expressed 
as part of the http stream between the client and the site. Or they can be 
expressed standalone and matched to a URL, as happens in the third-party 
label bureaus. A site can create its own PICS label, and it can also in- 
corporate PICS labels generated by others into its site. Thus some tools 
that can filter PICS labels posted on a self-rated site cannot necessarily 
read all PICS labels, especially those posted in a formatted list on a par- 
ticular PICS label bureau. Buyer beware: The expression "supporting PICS" 
has a lot of gradations! 


Right now, the protocols and the infrastructure around them are designed 
for matching and filtering: Select a URL, go to the site and see how it’s 
labeled, or look at the http stream it generates back. In the future, it 
will also be able to work more like the search engines, so that multiple 
PICS specs can be used to search and match within a database of ratings. 


Beyond filters 


Long-run, the most powerful use of PICS will include more than just a par- 
ser/filter, but agents that can execute complex queries with ranges, limits 
and Boolean logic, allowing a user to specify various combinations of 
labels to look for or avoid. In principle, PICS labels could be used by 
any application, for better or worse. Imagine a tool that automatically 
selected names from any site labeled above a certain rating for violence 
and sent out solicitations for guns or dangerous work of dubious character. 
Or a resume filtering tool could check out the URLs of prospective employ- 
ees’ employers to screen (in or out) for various kinds of affiliations. 

(Or you could use it to do research before the screening, to find out what 
sort of background correlated best with successful employees.) 


Indeed, PICS is a fine technology for agents -- the hot new software cate- 


gory that everyone wants but few people define. (Our version: Agents are 
autonomous programs that can be directed by users to perform a variety of 
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tasks.) The big problem with agents is usually specifying the precise con- 
ditions and objects that they might encounter; PICS is a wonderfully exten- 
sible protocol for doing just that. Now we just need to develop the agents 
to use it! 


Like any standard, PICS will gain value the more broadly it is used. Right 
now, it is starting to show up in various guises: in labeling tools and 
services, in the proliferation of ratings both from sites themselves and 
from third-party sources, and in filtering tools and browsers to use them. 


Labeling tools and services 


The biggest problem is that although many companies are now supporting PICS 
in their browsers, the folks who create Website development tools don’t 
seem to have even heard of the concept. 


Soon, a variety of Web development tools should allow one to build PICS la- 
bels semi-automatically, although mostly we are back in the early stages 
where people have to write their Labels by hand following a defined syntax. 
Remember when people had to write HTML code straight, before the days of 
FrontPage, PageMill and the like? With luck, those tools and others will 
soon offer a PICS-labeling feature as well. 


IBM's next release of its Webserver (4.2) will have good support for man- 
agement of PICS labels, keeping them separate from the page content. This 
means that it’s a good system for a label bureau, since it can match URLs 
and labels without inspecting the pages themselves. Even later next year, 
says staff programmer Martin Presler-Marshall, IBM will come out with a new 
proxy server that can filter for PICS labels, either for the client ma- 
chines it serves as a group, or for specific user IDs and IP addresses. 


Labels 


Then there's the content: the result and the purpose of the whole infra- 
structure. So far approximately 200,000 sites are PICS-rated. That’s a 
very rough number, because it’s impossible to account properly for double- 
counting and inaccurate estimates by raters -- but it does indicate that 
the system is gaining momentum. Nor are all the self-ratings "good" and 
the third-party ratings "bad." For example, of the 12,000 sites self-rated 
through the RSACi ratings service (page 21), about 3,000 rate themselves as 
having some sex, violence, nudity or vulgar language. Many adult sites are 
eager to keep children -- and government scrutiny -- away. Rating services 
provide both good lists and bad lists, or what Cyber Patrol calls CyberNOT 
and GyberYES lists. Parents can either limit their kids to "good" sites, 
if they want full control, or simply block out bad sites, if they have less 
concern about what their kids are up to. 


SafeSurf, a volunteer effort managed by a for-profit company, has already 
rated about 60,000 sites with PICS. Use of them is available to anyone who 
visits the sites in questions with a PICS filter. All these efforts are 
described in detail beginning on page 14. 
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Filters 


On the filter side, Microsoft has a PICS reader in Internet Explorer 3.0, 
while Netscape has promised to offer one soon. The IE "Content Advisor" 
defaults to no controls, but if you do want ratings, the RSACi ratings are 
the default choice. (Microsoft also bundles SurfWatch, to supplement what 
for now is a still limited range of PICS ratings.) 


Netscape has announced support for PICS and is solidly behind it in princi- 
ple, but it is unlikely to have a product for either client or server much 
before the end of 1997. Company employees such as Martin Haeberli vigor- 
ously support the concept, but there are other priorities, such as the 
focus on intranets... 


CompuServe provides a full version of the PICS-oriented Cyber Patrol 


filtering tool, downloadable free to its members; AOL offers its own paren- 
tal controls based on Cyber Patrol technology and its ratings database. 


MODELS FOR RATINGS 


Rating content is not an easy task. There is one broad distinction -- be- 
tween ratings done by a site/service itself, and those done by third par- 
ties. Let's consider self-rating first. 


In principle, self-ratings are likely to be most accurate since people know 
what they are producing. There are two major problems: They may have an 
incentive to fudge the truth -- in order to gain a wider audience, for ex- 
ample. Second, Juan’s criteria for rating his site may differ from Alice's 
criteria for rating hers, even though they use the same terms and the same 
rating scale. The best way to overcome this is to have certain objective 
criteria, such as RSACi’s. (As will be noted on page 21, RSACi has provi- 
sions for spot checks -- matching self-ratings against those derived by a 
panel of experts -- and responses to complaints.) 


Generally, self-ratings are maintained on the Websites themselves. That 
means they are conveniently available for filtering, but not so handy for 
matching search criteria. Most non-PICS labels are maintained in some kind 
of database by the originator; the goal of PICS is to make the rating en- 
vironment more decentralized, but it will need to allow for centralized 
searching as well. This tension between centralization for management and 
decentralization for all kinds of good things such as third-party ratings 
is a continuing feature of the Internet. 


Third parties: Distributed ratings 


Of course, the Internet covers territory much broader than a relatively 
defined universe of a few thousand games or movies a year. Moreover, we're 
considering not just software and static content, but also mailing lists, 
chat rooms, discussion sites, newsgroups and of course constantly changing 
streams of content at sites that are updated continually. 


This is ideal ground for a proliferation of third-party raters, or trust 


and reputation services. We expect to see a lively marketplace of compet- 
ing rating services -- just as in the real world there are restaurant 


Release 1.0 24 December 1996 


scsi ELSE ce nner aetna 


10 


ratings, seals of approval, best picks in magazines, reading lists from 
high schools, rankings of legislators by political groups, top-10 lists, 
special college issues and the like. In the online world, where com- 
munities are more far-flung, such systems make even more sense. 


One can imagine rating systems for almost any characteristic that is easily 
specifiable -- or for any group's or individual’s judgment. And they can 
rate locations or places or communities as well as static content. Some 
rating systems simply look at the words used, but the more sophisticated 
ones make judgments on a different basis -- more like editorial judgment. 
This site is filled with mature people with an interest in social action; 
that one is best-suited for teenage girls who want to talk about boys, 
models and make-up; that one is for my teenage girl, with discussions about 
female pilots, doctors and executives, such as Margaret Thatcher, Kay Gra- 
ham and Carol Bartz, ceo of Autodesk. 


Rating services will arise to rate other rating services. And of course 
there will be more rating services in general, because they will be easier 
for providers to set up and for customers to find and use. Want to know 
what people think of the airline you’re considering flying, or the hair- 
dressers in your new neighborhood, or the acupuncturists? 


Moreover, companies such as Firefly Network (see Release 1.0, 11-96) will 
allow people to find their statistical matches -- people whose tastes most 
closely correspond to their own. In return for using other individuals’ 
ratings, you simply have to post your own. Could you define your interests 
through a PICS label? In principle, it’s possible... although there are 
privacy issues to consider. You might not want to expose your interests to 
everyone -- just to people who share them. That's why such services will 
end up going through intermediaries; more in February. 


The value of such systems is that they celebrate diversity rather than 
obliterate it. Like-minded people and content can find one another and 
cluster, instead of losing out to majority preferences. 


Business models 


One question any company interested in PICS has to ask is: What's the 
business model? For software vendors, PICS support is a handy feature -- 
one that should be de rigueur within a year. And content providers will 
soon recognize the value of rating their own content. But whose rating 
scheme to use? Who will go to the trouble of developing ratings as third 
parties, and how will those third parties get paid? Meanwhile, consumers 
have to decide which ratings services to trust. 


Currently, most of the ratings/filter vendors are trying to gain market 
share through OEM deals with companies such as AOL (the lucky ones), vari- 
ous ISPs and modem manufacturers. The OEMs may not be making money them- 
selves, but they’re willing to pay a few cents extra a head to make their 
products more attractive. The initial lure of "use my browser/filter to 
use my rating service" won’t apply once PICS becomes prevalent. Later, 
says Brian Milburn of CYBERsitter vendor Solid Oak, his hope is to make 
money on Internet sales; retail-store sales aren't terribly lucrative be- 
cause packaging and distribution costs eat up most of the revenues. Other 
companies, such as SurfWatch and Cyber Patrol, are going after the corpo- 
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rate market. Currently, companies such as SurfWatch and Cyber Patrol offer 
the paid-product/ free-service approach: You pay for the filtering tool, 
and get the service -- access to updated ratings -- for a specified period. 


Open PICS platform makes profits a challenge 


But this business model is tough: A major goal of PICS is to separate any 
particular browser/filter from any particular ratings set; the standard 
means that any filter should work with anyone's ratings. And since there's 
no monopoly or even clear market leader on either side, exclusivity doesn’t 
bring much benefit. About the only company that really seems to get this 
point is Net Shepherd, which sells not just filtering tools and access to a 
ratings database, but also sells the tools for communities and other groups 
or companies to build their own ratings bureaus, with whatever business 
model they choose. 


These rating services themselves may charge for access to their labels or 
service, or they may try to sell advertising. However, a second major goal 
of PICS is to make labels machine-readable so that a search or link can be 
automatically completed or restricted. The way to use a ratings service is 
not to look at it, but to use it behind the scenes to guide access or sear- 
ches. Therefore, it doesn’t really offer much opportunity to display ad- 
vertising. (And any rating service that sold its ratings would soon go out 
of business, we hope!) However, some specialized ratings services may 
present themselves as search tools or as push tools, so that they could 
sell their own ads. 


Continued evolution 


The best business models will continue to evolve. In the long run, the 
value-added and the recurring revenues are likely to reside in ratings 
databases delivered as software-enhanced services, continually updated. 


Many of the initial ratings services will be voluntary and membership orga- 
nizations -- schools, teachers’ associations, religious groups, interest 
groups of various kinds such as the visually impaired who might rate sites 
for accessibility, political/moral/social-action groups such as Girls Inc., 
People for the Ethical Treatment of Animals and Mothers Against Drunk Driv- 
ing. Then there will be self-regulatory organizations such as RSACi and 
InternetWatch Foundation in the United Kingdom. The European Commission is 
suggesting that the ISPs in each country form such groups -- or it will do 
so for them! So yes, some misguided governments may try to require their 
citizens to use certain filters... 


Ratings-enhanced search 


Eventually, as more users start using PICS capabilities with their browsers 
and other tools, some entrepreneurs (and their investors) will see markets 
for a variety of rating-related businesses. Many ratings databases will 
end up being bundled in with the various search services, supported by 
advertisers rather than customers directly. (The search services will li- 
cense the use of the ratings databases to make their search systems more 
attractive to consumers and thus their audiences more attractive to ad- 
vertisers, but the advertisers needn’t be directly involved.) 
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The Magellan service of Excite, for example, already has its own proprie- 
tary list of "green" sites, rated appropriate for children by its own team 
of reviewers. There’s no reason it couldn’t offer the SurfWatch, RSACi or 
Net Shepherd (and affiliates) ratings as well. Cyber Patrol says it is 
working on ratings deals with some search companies, but won't give further 
details. In the other direction, SurfWatch has just concluded a deal with 
Yahoo, to use ratings from the Yahooligans directory of kid-oriented sites. 
That database (not PICS-compatible) is in SurfWatch’s WebTV version and 
will be in new releases of the SurfWatch product. 


Just as you can now select your search service from the Netscape home page, 
so will you be able to refine your query with a rating spec. A friend of 
ours complains that he gets too many sex sites even for the most innocent 
queries. That doesn’t happen to us, but maybe he’s mostly looking at cars 
and other "boy" things. He would pay a wee amount extra to avoid those on 
a regular basis, but he would not want an ISP that totally restricted his 
access. "I might have to do some research or something," he claimed with a 
straight face. 


As with all such deals, the ratings providers and the search companies will 
have to negotiate delicate trade-offs between exclusivity and market share. 


Bundled into a commmity 


Many ratings services are likely to pay their way as part of members-only 
services, where revenues are generated through membership or transaction 
fees. The ratings content won’t be charged for directly, but will be in- 
cluded as part of a broader offering. Services offering collaborative 
filtering, as described last month in Release 1.0, may also find the use of 
expressive PICS labels helpful (as long as they remember to protect users’ 
privacy!). The Zagats of the Net (ZagaNets?) will soon emerge. 


Ratings as assets 


Of course, the ratings providers will attempt to control their ratings as 
intellectual property, and users will likely share them with friends as a 
dubious exercise of fair use. This shouldn't be much of a problem as long 
as ratings providers don’t get overly paranoid -- and remember that they 
are providing a constantly changing stream of service rather than selling 
chunks of content. The fact that sites are constantly changing works 
strongly in the rating services’ favor. 


The point is simply that this is not an area to invest in carelessly. PICS 
itself is rigorously designed to be a standard rather than a profit center. 
Ratings will generally make money only in the context of some broader ser- 
vice, rather than as a standalone database. But taking a job doing ratings 
is likely to be a good entry-level career move: the mailroom clerk of the 
Internet. 


Forget the-entry-level job at McDonald’s! Join the knowledge economy by 
starting as a Website rater. No experience required! All the Internet ac- 
cess you can stand, at 64K and above!! 
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Issues 


But the rating approach isn’t trouble-free. It begs the question some 
people ask: Is there some content that simply shouldn’t exist -- that 
should be filtered from everyone? But that’s for another time... 


Two more immediate issues: Who owns the ratings? And who controls them? 


In principle, a service that develops ratings -- whether they are developed 
internally or gathered from users and Website managers themselves -- owns 
those ratings. It may offer the use of them as a service to the world at 
large (as most churches might do) or to members only (especially fee-paying 
members), or it may sell the (use of the) data and updates to users or 
third parties. But it needs to negotiate carefully the shoals between ob- 
sessive control and losing a proprietary edge. We discussed this dilemma 
in general in Release 1.0, 1-96. 


Meanwhile, if the service owns the ratings, what rights do the subjects of 
the ratings have -- especially those who have self-rated? Who rates the 
raters? Do the subjects of ratings get to argue back? To erase them? 
Dispute them? Even see them? Can they see the data on which they are 
based? What about a rating service that is sloppy, or one that is corrupt 
and takes bribes? Suppose Juan has a really bad experience at Alice's 
Restaurant and badmouths it to all the rating services, which base some of 
their ratings on consumer feedback? 


In the short run, that can be a problem, but in the long run -- fairly 
quickly the way the Web works -- the market should work. The unreliable 
rating services will lose customers, and Juan will be exposed as a petu- 
lant, obnoxious customer. His restaurant ratings will almost all be nega- 
tive, and people won’t trust his ratings anymore: He'll be rated out of 
the ratings-service feedback loop. That’s because most ratings services 
will use a large number of raters, and calibrate them against one another. 
Some reviewers will get reputations for unreliability, and their views will 
be disregarded. Some sites will use anonymous reviewers, and their judg- 
ments will reflect that. People who find a ratings service biased can com- 
plain -- and those who share its biases will use it happily. 


Of course, we need to start with a market that fosters good practices -- 
which is what PICS is trying to do. The basic assumption is that people 
can dispute the ratings, and various services may set themselves up as 
dispute-adjudication boards. Ratings services with bad ratings will lose 
market share. 


In extreme cases, people may sue under terrestrial laws, but that will be 
expensive and complicated -- as it is now. 


Release 1.0 24 December 1996 


TE REP Ac a TR SESS ET SI rete a AES anon attics 


14 


THE PLAYERS 


The table below outlines some of the key players; individual companies/ 
organizations are described in alphabetical order starting on page 14. 


Company 
(product) 


Microsystems 


(Cyber Patrol) 


Ket Nanny 


Net Shepherd 


PlanetWeb 


RSAGi 


SafeSurf 


Solid Oak 


(CYBERsitter) 


SurfWatch 


no of users 


200,000 


50,000 


NA 


NA 


NA 


10,000 


NA 


300,000 


no of sites 


rated* 


*15,000 no, 
40,000 yes 


2,500 


*14,000 


x44, 000 


*12,000 


*60,000 


2,700 


11,000 


source 
of ratings 


employees, 
teachers/parents 


employees 


volunteers, 
bureaus 


employees, 
students 


self-rating 
self-rating, 
volunteers 


self-rating 
(reads PICS) 


employees, 
contractors 


comments 


local monitor 


local monitor 


support for 
3-party bureaus 


focused on games 
& net devices 


free service, 
nonprofit org 


focus on ISPs, 
intermediaries 


free service 


PICS soon 


*indicates ratings that are PICS-compatible and available to the general 


public. 


such as newsgroups or FIP sites. 


Several of the services also control access to other Net resources 


Note: The numbers are unreliable, and should increase anyway over the holi- 


days. 
tivities. 


"Local monitor" means that the software monitors the user’s ac- 


Describing the companies involved in content-rating is a challenge, since 


they are typical Net companies: 


no notice. 


They change form and business models with 
But that very diversity shows the potential success of PICS: It 


is fostering precisely the kind of decentralized, pluralistic profusion of 


products, services and business models that its creators hope to see. 


More- 


over, they are not typical Silicon Valley companies; there is not a Kleiner 
Perkins dollar among them. 
from those oil-oriented investment pools that populate the Canadian stock 


exchanges; one (PlanetWeb) is partly a Silicon Valley re-start. 


Two (Net Nanny and Net Shepherd) have funding 


Solid Oak 


and SafeSurf are very private, and RSACi and InternetWatch Foundation are 


nonprofit industry coalitions. 


Only SurfWatch did the traditional Silicon 


Valley start-up and then got acquired; Microsystems is a standard-issue pri- 
vate company based on Massachusetts’ Route 128. 
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Almost all the tools do more than just filter the Internet based on labels. 
They can filter based on specific words in the URLs, or on a text search of 
a particular page or site. And they use those tools as well as human in- 
spection to develop or validate the labels. 


Two further trends are notable. The first is that many of the vendors are 
quickly coming out with corporate versions, designed for employers rather 
than parents, for blocking employees access not just to smut and violence 
but also to productivity-destroying games, potentially virus-ridden down- 
loaded software and time-wasting chat rooms. They include audit trails, 
scheduling tools that make a distinction between work time and leisure time 
such as lunch hours with the rules relaxed to allow game-playing, and user 
profiles to assign workers to categories with different levels of restric- 
tions. (Some of these are similar to the technical requirements for ISP 
versions, but implemented with a different flavor. Proxy server versions, 
meanwhile, don’t always allow per-user or group configuration.) This trend 
makes "real engineers" happy, because the consumer market likes simplicity, 
while the corporate market is willing to accept a higher level of complex- 
ity in exchange for granular control and configurability. 


The second trend is to filter what a child or employee sends out -- every- 
thing from a revealing home address, a credit-card number or confidential 
corporate information. "If you can define it, we can block it," says Net 


Nanny. Of course, "I know it when I see it" isn’t good enough for such 
systems, but character strings such as a credit card number are easily 
detected and filters. Says Net Nanny: "At least they won't be using your 
[credit] cards!" However, the technology isn’t foolproof, even though Net 
Nanny’s for one is based on powerful underlying pattern-recognition tools. 
It may block innocent but misspelled words, or let out slight variations 
that may be revealing. Thus, it may offer a false sense of security. 


Not listed here, Novell is promoting similar capabilities in its newest 
version of NetWare, in an approach called border services that supports 
monitoring of what comes in and what goes out of any corporate intranet. 
You can expect to see similar positioning from many infrastructure and 
middleware vendors over the coming year. 


Diversity in content; diversity in companies 


The companies/offerings that are listed here range from dedicated everyone- 
to-his-own-shared-value ratings (Net Shepherd) to targeted-at-conservative- 
families-and-proud-of-it (CYBERsitter). Cyber Patrol (Microsystems) is 
probably the most traditional corporate-style company, with an existing 
business in corporate scheduling tools, while SafeSurf is essentially a 
volunteer effort turned for-profit in order to sustain its existence. Net 
Nanny has a strong technical background in telecom and computer security. 
SurfWatch was a typical Silicon Valley start-up focused on the single prob- 
lem of parental control; it is now part of Spyglass, increasingly focused 
on the brand-oriented corporate market and the Internet device (WebTV) 
market. OEM-oriented PlanetWeb sells filter-enhanced browsers for game ma- 
chines and Internet appliances. SurfWatch is generally considered liberal, 
CYBERsitter conservative -- just the diversity you'd want to find in rat- 
ings services that seek like-minded customers. Others focus on providing 
"objective" information and have less visible biases. 
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Cyber Patrol (Hicrosystems Inc.) 


Cyber Patrol is a product of Microsystems Software Inc., a private company 
in Framingham, Massachusetts. Unlike most of the rating services listed 
here, Microsystems serves the corporate world with products such CaLANdar, 
a LAN-based scheduling tool, which augurs well for its new corporate ver- 
sion of Cyber Patrol. The company also offers a family of products for 
people with disabilities (low-vision and motion disabilities); it’s no 
stranger to social issues. 


A key player in the PICS consortium (abetted by geographical proximity to 
Cambridge), Microsystems is committed to the PICS movement; marketing 
director Susan Getgood is a member of the Cyber Patrol team and Micro- 
systems’ representative to PICS. Cyber Patrol is reworking its filtering 
service to make it PICS-compatible. Thus, the Cyber Patrol filter can now 
read RSACi labels with no reconfiguring by the user; on the other hand, 
users still can’t read all other PICS labels or PICS ratings file -- al- 
though there aren't that many yet. 


The company has thought carefully about many of the issues involved, says 
Getgood, director of marketing. For example, the "CyberYES" list includes 
about 40,000 sites rated as good for children, with no links to any "bad" 
sites. Microsystems posts that list as a Website called Route 6-16 with 
links to the sites on the list, but it doesn’t use PICS labels yet. But it 
keeps the CyberNOT list confidential, partly because publishing that list 
would most likely encourage kids in search of adventure to go hunting down 
the list. Any Webmaster, of course, can find out the rating of his own 
site -- and ask how it got that rating. "We respond to everyone," says 
Getgood with conviction. When there are disputes, Cyber Patrol convenes 
all of its raters, about ten people currently, to rate a particular site, 
and then averages the results. Those raters are all parents and teachers 
who are paid to do the ratings; the company eschews volunteers because they 
don't provide consistent ratings. The company also periodically convenes 
an oversight council of representatives from organizations such as the Na- 
tional Organization for Women, the Gay and Lesbian Alliance Against Defama- 
tion, church groups and other interested parties. 


So far the Cyber Patrol team has signed up both CompuServe and AOL, who 
supply it (or a version of it) to their customers free as the default In- 
ternet filtering system. The company has also sold it to numerous schools, 
and estimates it has about 200,000 users -- a very rough estimate! The 
software sits on the user's PC (or the school’s server) and can be config- 
ured by a parent or other password-possessor. It stores the two lists and 
whatever other restrictions a parent has set locally; it automatically 
downloads changes to Cyber Patrol'’s list when the user logs on to the Net. 


Cyber Patrol is getting good early returns for its LAN-based corporate 
product as well, says Getgood. Now in beta, it addresses three issues, she 
notes: productivity, avoidance of liability, and vulnerability to outside 
security risks. The cost ranges from a high $50 per user in small quanti- 
ties to $10 per user in batches of a thousand or more. 


Microsystems is private and won't discuss financials, but Getgood says the 
65-person business is profitable. 
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GYBERsitter (Solid Oak) 


Solid Oak is a venerable Santa Barbara-based development company founded in 
1986 that long did software for other companies; it started selling under 
its own name a couple of years ago. Its CYBERsitter, first released in 
mid-1995, is a filter that works with any browser using standard Winsock 
connections. Its filter originally worked only with its own VCR (Voluntary 
Content Rating) ratings, which were designed to be much simpler to generate 
than PICS labels -- sort of the cyberspace equivalent of Jack Valenti's 
television ratings, except that they’re not imposed on an entire industry. 
"Those [other] ratings services are free now, but sooner or later they'll 
start charging," says founder Brian Milburn darkly. 


Nonetheless, in response to demand, CYBERsitter can parse PICS ratings, in 
addition to the VCR ratings of an estimated 2,700 sites. It also blocks 
another 10,000 sites selected by a review committee at Solid Oak or 
reported by customers or found by search tools looking for offensive words 
and phrases. Milburn sees his system as the voice of the people -- people 
too poor or simple to go to a complicated service but eager to rate them- 
selves. "There are about nine companies that do 50 percent of all the 
[really smutty] content on the Net, and they are glad to keep children 
out," he adds. "One of them rated 20 different domains that it operates." 
It and its competitors have all rated themselves with VCR, he says -- and 
by now probably with PICS as well. 


The company won't disclose how many users it has, but it has distributed 
hundreds of thousands of copies through other vendors. CYBERsitter comes 
in the box along with a variety of net-oriented products, including those 
from Hayes, Quarterdeck and McAfee. It also has a deal with VirginNet, the 
new ISP started by Richard Branson of Virgin Airlines. Or you can download 
it off the Net for $39.95. 


"We target the conservative family; our customers are happy with the sites 
that we block. That’s who we’re trying to please -- our customers," says 
Marc Kanter, director of marketing. The company has gotten into tangles 
with zealous free speech advocates who forget that freedom of speech in- 
cludes the right to be very selective about content -- as long as that 
choice is not imposed on others. 


InternetVatch Foundation (UK) 


While the United States had (and unfortunately still has) the Communica- 
tions Decency Act and an overwrought and inaccurate article in Time maga- 
zine, the United Kingdom had its own attention drawn to objectionable con- 
tent on the Net by a series of overwrought and inaccurate articles about 
child porn on the Net that appeared in the Observer last summer. The in- 
dustry, more tightly knit and also smaller than its US counterparts, quick- 
ly banded together, and the two major associations, the Internet Service 
Providers Association and the London INternet EXchange (LINX), met with of- 
ficials from the UK Home Office (which oversees the police) and the Depart- 
ment of Trade and Industry. 


With urging and funding from Peter Dawe, the now-retired-from-business 
founder of Pipex who recently sold his company to UUnet, they set up 
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SafetyNet, which quickly turned into the InternetWatch Foundation for 
copyright reasons. Says chief executive David Kerr: "Our first objective 
was to establish a report line for users to report on illegal material." 
ISPs undertake to remove potentially illegal material, with or without the 
cooperation of the poster, and to inform InternetWatch of any problems. If 
there are continuing problems or in all cases of child pornography, Inter- 
netWatch informs the police. "Generally, the understanding is that the po- 
lice will not pursue cooperative ISPs," says Kerr. 


The Foundation’s second objective was to decide how to create some kind of 
rating system for legal material that still might not be suitable or in- 
offensive for everyone. Kerr is now in the process of pulling together an 
advisory board, to be composed of representatives of the ISP business, 
voluntary organizations and representatives of other media such as the BBC. 
He will present them with the options and some questions. "One thing is 
quite clear," he says, "and that is that we'll use PICS. As far as I'm 
aware there's no UK ratings system, and we need to figure out what it means 
to have a UK system, how we differ from what you have in the US. How do we 
deal with local issues and still map to some international rating system?" 
Certainly in the UK (and Canada and Australia) more than most other coun- 
tries, US content is extremely "present" by virtue of the English language. 


But the UK differs from the US in one important respect: "Whatever we do 
here," notes Kerr, "has the potential of being adopted all over Europe. 
The European Commission is watching us closely." He wants to extend the 


general RSACi approach, but with refinements suggested by members, includ- 
ing a rating of "not suitable for children" even though it may not contain 
any of the items in the RSACi ratings -- discussions of euthanasia, for ex- 
ample, or perhaps drugs or racial intolerance. The group also plans to 
launch a program to rate all the newsgroups -- which by their very nature 
don’t have a single person who could do a self-rating. We also think that 
the inclusion of binary files might deserve a flag -- not a rating, per se, 
but an indication that a site probably should be rated to make its charac- 
ter clear. Overall, the InternetWatch approach makes a lot of sense: we 
just hope it doesn’t crowd out all alternative systems in the UK -- or in 
Europe. 


Net Nanny 


Net Nanny’s previous identity was Trove Investment Corporation, a former 
mining company turned into an investment pool. In 1989, it called in Gor- 
don Ross, a consultant with years of experience in telecommunications and 
security, to assess some security technology involving keystroke and retina 
patterns. "I liked the technology so much we bought it and hired the 
people, and now I’m running the company!" he says. 


In 1994, seeing a market in consumer security, Ross launched development of 
Net Nanny, a tool that applies pattern recognition to watching a user's ac- 
tions and preventing whatever the system administrator has forbidden. To 
quote Net Nanny’s own Website: "To protect family members from uninvited 
electronic visitors, parents can load personal information like children’s 
names, home address and telephone numbers. To keep kids from using credit 
cards online for various unauthorized transactions the appropriate numbers 
can be loaded into Net Nanny’s dictionary. At least they won't be using 
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your cards! .... Net Nanny isn’t limited in terms of type of content. So 
you can screen and block anything you don’t want running on your PC like 
bomb-making formulas, designer drugs, hate literature, Neo-Nazi teachings, 
car theft tips -- whatever you're concerned about. If you can define it Net 
Nanny can block it!" That job of defining it is still a challenge... 


With the advent of the Internet, the company developed a list of 10,000 
blockable sites, focusing on pornography, violence and hate literature, 
bombs and drugs. The ratings are done by three employees, contractors and 
volunteers. This list is in Net Nanny’s own format; user/administrators 
can see a text version and add or delete sites of their own choosing. 
Starting in January, they can also configure Net Nanny to use outside PICS 
ratings with their own criteria and choice of ratings service. 


Registered users of the Net Nanny package, who currently number about 
50,000, can download the list at any time; it doesn’t update itself auto- 
matically. The company sees that as a benefit; the user is in control. "We 
don’t want to impose our values," says Graham Heal, marketing manager. 


Ross stresses that the service is much broader than a Net filter. It fo- 
cuses on user customization, including filtering by the presence of words 
and controlling materials sent out as well as what is viewed or downloaded. 
For example, it sees AOL as a bulletin board, although a large one (!), and 
can selectively block use of chat rooms, or it can work with virtually any 
Windows application, blocking use of an application, or e-mail from or to a 
particular address. All this, of course, is a specialization of the compa- 
ny’s broad pattern-recognition security technology. 


The software is sold mostly direct (retail or over the Net, for about $30 
to $40, which includes indefinite access to the Net Nanny blocking list). 
The software is sold through distributors such as Ingram Micro, and there 
is a Kanji version in the works with a Japanese partner. The company’s 
corporate version offers pretty much the same capabilities, with some addi- 
tional auditing features. And oh yes! -- the company changed its name this 
month from Trove Investment Corporation to Net Nanny International Software 
Inc. 


Net Shepherd 


Net Shepherd is a company based in Calgary, Alberta, that recently went 
public on the Alberta Stock Exchange through a merger with a capital-pool 
company called Enerstar. The company was founded in 1995 by Ron Warris, a 
corporate IS manager, who was helping a friend to connect a home PC to the 
Net. The friend commented how great this would be for his kid, but... 
Warris saw a need and an opportunity. 


The company is using the $750,000 (Canadian) it gained in the recent fi- 
nancing plus some other funds in a grandiose plan to rate much of the Net. 
It is attempting to mobilize all the teachers of Canada (and ideally all 
North America) and other volunteers to rate a substantial portion of the 
Net using Net Shepherd's labeling system, based on PICS. In addition, it 
is working with a Vancouver firm called Mark Trend, which has hired and 
trained 500 people to do the same, with another 500 to be added. The plan 
is to jumpstart Net ratings well beyond the puny 200,000 or so sites rated 
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so far, and rate 60 million pages (or some 10s of millions of sites). The 
Net Shepherd service is designed to encourage collaborative rating, where 
individuals and groups can simply add their ratings to the tally for each 
site. This encourages quality control all by itself. The organizations 
pay a license fee and can develop not just their own ratings, but their own 
vating criteria. 


The Net Shepherd business model is to sell the tools and services for all 
this to businesses, schools, companies and what it calls shared-value orga- 
nizations. Those organizations can build subdatabases of ratings, like the 
collaborative filtering systems we described in the November Release 1.0. 
Net Shepherd also stays involved as the manager of the giant ratings data- 
base of all the ratings combined, and as the vendor of software or hosting 
services to the communities that develop their own. Thus a user can see 
how everyone rated a site, or how just the members of his own group as- 
sessed it. 


Eventually, the company hopes to team up with a brand-name search service, 
so that people can search on the ratings instead of simply using them in a 
binary way for filtering. 


Will Net Shepherd's schemes pan out? We're not sure, but it certainly has 
the vision. It has the most interesting Website of the companies listed 
here, with pointers not just to product information and PICS pages, but to 
thoughtful political pieces about censorship, self-rating and annotation 
systems. It also makes a point of its support for French-language services 
~- a handy thing in Canada...and eventually in France! 


PlanetWeb 


PlanetWeb is the new home for the assets of a moribund Redwood City company 
called NewView, which was developing a PICS-based rating system. 

PlanetWeb, itself owned mostly by management and with an investment from 
Sega, acquired the assets last fall for use in its own browser, targeted at 
the OEM market for (of course) game machines and Internet appliances. So 
far the company has sold tens of thousands of copies of its browser for 
Sega NetLink systems in the US and Brazil. 


The browser includes the PlanetWeb Parental Control System, the former New- 
View technology. Since Internet appliances do not have local storage, the 
company has come up with some interesting technical approaches. The client 
machine is too small to hold its own list of restricted or allowed sites, 
but at the same time forcing every query to go through a single proxy serv- 
er would likely result in horrible performance problems. The solution is 
to send out two messages from the client machine every time the user re- 
quests a URL: one to the desired site, and the other to the PlanetWeb serv- 
er. The PlanetWeb server resolves the query against its list and the 
user’s settings (which are all stored on PlanetWeb'’s server), and then 
sends a message back to the client machine to let it know whether it can 
display the requested site. This all relies on the fact that any interest- 
ing Website takes longer to download than it takes PlanetWeb to clear the 
transaction. To avoid a single point of failure, PlanetWeb is planning to 
set up multiple servers at different physical and virtual locations. We 
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just hope it doesn’t get too successful too quickly -- such as the day 
after Christmas! 


Actual use of the ratings server has been below 10 percent of users, says 
ceo Kamran Elahian (chairman of ceo of NeoMagic currently and also founder 
of Momenta and Cirrus Logic, among other companies). He's hoping that pro- 
portion will jump as a result of Christmas sales, as the Sega Netlink 
parents have bought for children move from the shelves and under the trees 
into actual use. 


PlanetWeb has rated about 44,000 sites, using mostly part-time graduate 
students working with a supervisor who is a full-time employee. The compa- 
ny avoids volunteers in order to establish some consistency across the 
ratings, Elahian says, although it certainly takes input from parents to 
guide the sites it rates. 


Of the 44,000 sites (750,000 pages) rated, most are suitable for children 
on the basis of about 10 criteria; the focus is on providing approved sites 
and a greater degree of safety than you can get just by blocking known 
"bad" sites. Generally, the company does not support PICS, but it still 
maintains its PICS server from the NewView days. In principle anyone with 
a PICS browser can query it, and it works off the same database as the new 
PlanetWeb server, so it is up to date. Since the service is free, Planet- 
Web doesn’t promote it, but it keeps it up as a low-cost gesture of good 
will. 


RSACi 


The Recreational Software Advisory Council, an independent nonprofit crea- 
tion of the Software Publishers Association which rates computer games (and 
keeps government heat off that industry), has formed a new unit, RSACi (for 
Internet). It has the leading database of PICS labels available to the 
general public, covering about 12,000 Websites. 


RSACi is a self-rating service that lets sites rate themselves by answering 
questions and that generates PICS labels for them automatically. RSAC 
charges for its game ratings, but it wanted to make this system cost-free 
-- both to encourage use and because it’s complicated to pay over the Net 
anyway! So, says executive director Stephen Balkam, he went after 
sponsors, and eventually got $100,000 each from Microsoft and the Software 
Publishers Association, $50,000 from CompuServe, all the hardware he needs 
from Dell, and implementation assistance from USWeb -- along with a commit- 
ment to encourage all USWeb clients to rate their sites with RSACi. 


To self-rate, a Webmaster goes to the RSACi site and answers a set of bran- 
ching questions with a yes or no ("Does it have blood and gore?"), and the 
tool calculates a set of ratings from 0 to 4 in four categories: sex, 
nudity, language and violence. RSACi e-mails him the code for the label to 
place it on his Website, along with a symbol for visual display. Although 
the service is free, the Webmaster does have to fill out a contract before 
he goes through the rating process, certifying that he will not willfully 
misrepresent anything. That gives RSACi enforcement rights if there are 
any problems later. RSACi also will have a Webcrawler to search for 
spurious RSACi ratings. So far, only three sites have had their ratings 
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questioned; two had made genuine mistakes, says Balkam, and the third de- 
cided to withdraw its rating. 


Among notable users of RSACi for self-rating is CompuServe, which has rated 


all its Websites -- still a tiny part of its overall content. As it in- 
creases its presence on the Web, the company promises, it will rate each 
new entry in turn. "Our intent is to go with whatever standard ratings are 


available," says spokesman William Giles. 


In the European Union, the Directorate dealing with telecom issues, DGXIII, 
has backed the notion of self-regulation and even commended RSACi (with 
some reservations) in its official report, says Balkam. The chairman of 
the Australian Broadcasting Authority, Peter Webb, recently backed both 
PICS and RSACi in a public address in Sydney. And, he adds, "interest" has 
emerged from Norway, Canada, Spain, Singapore and China (for example, the 
Shanghai Tourist office has already rated its site). 


SafeSurf 


Two years ago, Ray Soular and Wendy Simpson co-founded SafeSurf "as a mis- 
sion," they say. They organized a volunteer effort to develop ratings, 
collecting the combined efforts of teachers and parents from all over, as 
well as self-ratings. Simultaneously, the company started development on a 
filtering system, incorporating both a rating system and ISP filtering 
software. It folded that effort into PICS, where it was a founding member 
of the PICS technical committee, and now uses PICS protocols throughout. 


The company’s focus is a broad-ranging rating system, using more than 100 
volunteers, mostly parents and educators. Although they are volunteers, 
SafeSurf tries to coordinate and quality-control their efforts. When a 
Webmaster requests a rating by filling in a form at the SafeSurf site, a 
volunteer is assigned to inspect it. The company has rated about 60,000 
sites, focusing on "safe" ones, with ratings giving suggested age levels 
and content ratings in nine different categories. When Webmasters who re- 
quested a rating don’t pass, which would allow them to display the SafeSurf 
logo, the company will explain why not. "Mostly, it's a negotiation, a 
discussion," says Simpson. "We've never had to tell anyone don’t use the 
system. Anything beats censorship!" Webmasters who pass get the right to 
display the SafeSurf logo, along with their PICS label that can be read by 
SafeSurf’s or another PICS-compatible filter. 


The SafeSurf approach is to pay attention to the uniqueness and context of 
Internet content; its volunteers notice, for example, whether a breast 
belongs to the Virgin Mary, the latter-day Madonna or a medical specimen. 
"A rating system has to look at how an item is used," says Simpson. "A 
parent can decide which is acceptable and which is not." 


The business model is still evolving: It includes sponsoring a parents’ 
organization, taking advertising for its Website and a forthcoming family- 
focused Website, and selling software to schools, libraries, businesses and 
ISPs. The filtering side generally operates on a server, allowing the es- 
tablishment of family-safe clients without any local software. If the 
customer is an ISP, its customers, usually parents, parent get passwords, 
and their children get different passwords, and are assigned different 
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levels of filtering (mot individually configurable). The ISP or server ad- 
ministrator can change the URL list, Soular notes, but most don’t want the 
hassle: "Most parents just want their children protected; that's their 
main goal. In fact, they usually tell us to protect them more!" But at 
the same time they can have their own adult account. 


The company uses a variety of its own infrastructure software, including a 
Webcrawler that detects sites that have been changed, text tools that 
detect the presence of specified words (for assistance in ratings), and 
other tools for mapping sites. The focus is on checking the validity of 
"safe" ratings, says Soular: "Once a site is rated beyond a certain level, 
we don’t consider it a priority. If someone feels their site should not be 
accessed by children, fine. We focus on sites that do accept family traf- 
fic. They get inspected by humans." 


"We created our rating system as a gift for the Internet," says Soular. 
"There is no charge to use it, but we're looking for organizations to 
sponsor it." He also wishes search engines would adopt PICS, to make the 
whole approach spread faster and wider. 


The company sells its software and service primarily to intermediaries -- 
ISPs, schools, libraries and corporations. Technically, its focus is on 
servers rather than individual PCs. The server administrator can configure 
it with ratings, and also with specific URLs. The server maintains the 
list and downloads updates every 24 hours. So far it has sold the system 
to ten ISPs, seven schools, and a growing number of libraries and com- 
panies. The pricing amounts to about $1 per client per month in volumes of 
hundreds of users. 


Simpson, single, and Soular, with an eight-year-old daughter, started the 
company two years ago. She was a retail manager with the Hahn Company and 
is now studying child psychology; he was an industry veteran with experi- 
ence ranging back to Commodore’s VIC-20 and a co-designer of the MIDI spec. 
Soular is proud to have done much of SafeSurf’s technical work himself. 
But, he says, "As soon as we saw PICS, we realized that this was the op- 
portunity to create a universal protocol. We gave up proprietary value, 
but we gained a universal system with immense expandability." 


He continues, "We're trying to achieve a rated Internet. The purpose of 
our profit side is to fund the nonprofit side. We believe it’s the right 
of a person to know what sort of content is going to enter their home." 
The company is funded by individual investors who believe in a safe Inter- 
net, he adds. 


SurfWatch 


SurfWatch is the grand-daddy of the filtering services/tools and got its 
start in 1995, well before PICS appeared. Thus, although the company sup- 
ports PICS politically and in principle, it hasn’t yet come out with a ver- 
‘sion that can parse PICS labels. It uses its own filtering list of 11,000 
bad sites, and also relies on simple text-matching to block about 25,000 
sites altogether. The company was acquired last spring by Spyglass, which 
is enthusiastic about its direction, but the acquisition slowed development 
plans somewhat. SurfWatch’s most pressing concern has been the release of 
a corporate version. 
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The company is an active member of PICS, and plans to release products that 
use the protocol soon. So far, it has shipped or downloaded about 3 mil- 
lion copies since its founding -- accounting for about 300,00 users cur- 
rently, founder Jay Friedland estimates. (That larger figure includes, 
among others, 300,000 copies shipped with CompuServe’'s version of Internet 
in a Box in a service for kids that has been mostly abandoned.) 


Although it made its name with a retail product, the company is now in- 
creasingly turning its attention to the OEM and ISP market. Customers in- 
clude Microsoft, AT&T, Netcom, Earthlink, Pacific Bell, Southwestern Bell, 
HK (Hong Kong) Net and WebTV. "We changed our business model to focus on 
trying to get ISPs to bundle, and they pay us on the overall number of 
users they have, not on how many actually use it," says Friedland. "The 
fact is, offering a parental control feature was more important as a 
marketing feature than whether people actually used it." On the other 
hand, he notes, the market closest to his heart is education: SurfWatch is 
in more than 8000 schools and school districts, where the company’s support 
for the Macintosh has really paid off. School prices range down to about 
$1 per pupil for more than a few thousand users, 


The two newest money-making initiatives are the OEM deal with WebTV (fig- 
ures undisclosed) and a corporate server. Technically, the product has its 
own little edges, Friedland points out. For starters, it has its own list 
of about 11,000 sites to block, generated by a team of four full-time 
people and more than 20 contractors (parents, teachers, and grad students) 
worldwide. The system is clever enough to block not just the sites’ URLs, 
but their IP addresses. Playboy, For example, has seven IP addresses, 
Friedland notes. If someone happens to know them he can often get around 
other blocking tools. SurfWatch also filters out another 14,000 sites by 
blocking outgoing queries instead of waiting for the URLs -- all queries 
with the word sex, for example. 


The system rates each site yes or no in four categories -- violence, sex, 
drugs/alcohol/tobacco and gambling, and the parent can select any or all of 
those four to block. Other vendors consider the all-or-nothing approach of 
SurfWatch to be a disadvantage, but Friedland stresses that in the real 
world people like simplicity. "Early on I was a big proponent of feature 
creep," he admits, but feedback suggested that people found the configura- 
tion process difficult. "I got one call from a teacher who had just spent 
45 minutes configuring some other system, and then it crashed...." The 
all-or-nothing approach also encourages children and teachers or parents to 
work together, he adds, since an adult can’t simply allow a single site or 
two that the child has valid reasons to use. Instead, the adult has to 
turn the whole thing off, and then presumably stay with the child to make 
sure the new freedom isn’t abused. 


"We're really big supporters of PICS as plumbing, but we still need to 
build a critical mass of qualified rating systems and ratings," says Fried- 
land. 


3 Note that this is the policy that Microsoft used to use for Windows, but 
SurfWatch is hardly a monopolist. 
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LOSING CONTROL: A NEW ATTITUDE 


In the end, people and companies will have to start feeling comfortable 
with the proliferation of ratings that they don’t control -- and trust the 
market to sort things out. The fact is, right now people all around your 
social and business circle are saying things about you that you might not 
like. But you don’t post company representatives at cocktail parties to 
protect your good name. Nor do you probably know everything that is being 
said about you on the Net even now. The difficulty, of course, is that 
cocktail party conversations usually vanish, or at least are treated with 
appropriate skepticism. Stuff on the Net lives on. On the other hand, it 
is easier to find and correct, and comments can be appended to explain 
other comments. In short, there will be a decentralized, Web-like system, 
rather than a hierarchy of control to keep things in check. 


Will all this work perfectly? Of course not. But whom would you like to 
put in charge? And what proportion of the rest of the world would agree 
with you? 


A final thought: This newsletter is in itself a form of very fuzzy third- 

party rating system. First we establish the rating criteria, which are not 
necessarily along a spectrum from good to bad, and then we attempt to posi- 
tion the various entities within the rating space. We hope you enjoyed it! 


COHING SOON 


e Conversation tools on the Net. 

e Labels and disclosure for privacy and 
security. 

e Navigation. 

e The analog world. 

e And much more... (If you know of any 
good examples of the categories listed 
above, please let us know.) 
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RESOURCES & PHONE NUMBERS 


Paul Resnick, AT&T, 1 (908) 582-5370; presnick@research.att.com; 
www.vresearch.att.com 

Bill Burrington, Doug Miller, America Online, 1 (703) 448-8700, 
billburr@aol.com 

William Giles, Kent Stuckey, CompuServe, 1 (614) 457-8600, 538-4600; 
kent@csi.compuserve.com 

Lori Fena, Stanton McCandlish, Electronic Frontier Foundation, 1 (415) 436- 
9333; fax 1 (415) 436-9993; lori@eff.org, mech@eff.org; www.eff.org 

European Commission site, www2.echo.lu/legal/internet.html 

Christine Varney, Federal Trade Commission, 1 (202) 326-2171; fax 1 (202) 
326-3441; cvarney@ftc.gov 

Martin Presler-Marshall, IBM, 1 (919) 254-7819; martinm@raleigh. ibm.com 

David Kerr, InternetWatch Foundation (formerly Safety Net), 44 (1223) 
237700; fax, 44 (1223) 235870; davidk@dial.pipex.com; 
www. internetwatch. org.uk 

Megan Bowman, Microsoft, 1 (206) 936-9425; meganbo@microsoft.com 

Scott Berkun, Microsoft, 1 (206) 882-8080; scottber@microsoft.com 

Susan Getgood, Microsystems Software Inc. (Cyber Patrol), 1 (508) 879-9000; 
susang@microsys.com; www.microsys.com 

Martin Haeberli, Netscape, 1 (415) 937-6904, (800) 561-6827; 
martinh@netscape.com 

Graham Heal, Gordon Ross, Net Nanny, 1 (604) 662-8522; fax, 662-8525; 
grahamh@netnanny.com, gordonr@netnanny.com; www.netnanny.com 

Don Sandford, Kevin MacDonald, Net Shepherd, 1 (403) 218-8900; 
kevin.macdonald@netshepherd.com, don.sandford@netshepherd.com, 
www.netshepherd.com 

Neil Donohue, Katrina Larson, Novell, 1 (801) 861-5593; kalarson@novell.com: 
www. novell.com/ear 

Judy Li, Kamran Elahian, PlanetWeb, 1 (408) 982-4688, fax (408) 982-4699, 
jli@planetweb.com; www.planetweb.com 

Stephen Balkam, Recreational Software Advisory Council/RSAGi, 1 (617) 860- 
9888; fax 1 (617) 860-9604; sbalkam@rsac.org; www.rsac.org 

Wendy Simpson, Ray Soular, SafeSurf, 1 (818) 597-8505 or 902-9390; 
wendy@safesurf.com, raymond@safesruf.com; www.safesurf.com 

Brian Milburn, Marc Kanter, Solid Oak Software (CYBERsitter), 1 (800) 388- 
2761 or (805) 967-9853, (805) 892-2557; fax (805) 967-1614; 
www. solidoak. com 

Jay Friedland, SurfWatch/Spyglass, 1 (415) 948-9500; jay@surfwatch.com; 
www. surfwatch.com 

Jim Miller, Sally Khudairi, World Wide Web Consortium/HMIT, 1 (617) 253-3194, 
253-8036; jmiller@w3.org, sally@w3.org; www.w3.org/pub/WWW/PICS 
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~~ RELEASE 1.0 CALENDAR 


. 1997 


January 8-10 Software, Services and Networking Conference - Scottsdale, 
AZ. Sponsored by Morgan Stanley. With Intuit’s Scott Cook, 
Netscape’s Jim Barksdale and so many more. Call Chena 
Dederian, (212) 761-7334; (212) 761-8900. 

January 15 Massachusetts Software Council’s 1997 Annual Meeting - Bos- 
ton. Sponsored by Massachusetts Software Council. With Key- 
notes by Mitchell Kertzman, Sybase and Matthew Cutler, Web- 
master’s Guild. Call Kelsey Cleveland, (617) 437-0600; fax 
(617) 437-9868; info@swcouncil.org; www.swceouncil.org. 

January 19-21 1997 Trends & Forecasts - Scottsdale, AZ. Sponsored by Inter- 
active Services Association. Call (301) 495-4955; fax (301) 
495-4959; ISA@isa.net; www.isa.net. 

January 23-25 Economics of Digital Information - Cambridge, MA. Sponsored 
by John F. Kennedy School of Government, Harvard University. 
Focusing on the economics and business models of publishing 
digital information. Submit your papers! Call Nora O'Neil, 
(617) 496-1389; fax (617) 495-5776; nora_o’neil@harvard.edu; 
ksgwww.harvard.edu/iip. 

January 26-30 Lotusphere "97 - Lake Buena Vista, FL. Sponsored by Lotus. 
Call (800) 655-6887, outside US, (716) 264-4337; fax (800) 
859-8369, outside US, (716) 264-4311; www.lotus.com. 

January 28-29 Digital Frontier Conference - Evanston, IL. Sponsored by Kel- 
log Graduate School of Management. Call (888) 332-1997; 
DFC1997@nwu. edu; www.kellog.nwu.edu. 

January 28-31 RSA Data Security Conference - San Francisco. Sponsored by 
LKE Productions. Call (800) 340-3010 or (415) 544-9300; fax 
(415) 544-9306; info@lke.com; www.rsa.com. 

February 3-6 ComNet '97 - Washington, DC. Sponsored by NetworkWorld. With 
John Chambers of Cisco Systems. Call (800) 545-EXPO; fax 
(617) 440-0359; www.mha.com/comnet/. 

January 3-6 Lotusphere '97 - Nice, France. Sponsored by Lotus. Call (800) 
655-6887, outside US, (716) 264-4337; fax (800) 859-8369, 
outside US, (716) 264-4311; www.lotus.com. 

February 8-12 MILITIA "97 - Cannes, France. Sponsored by Reed Midem Organi- 
zation. Contact Diana Butler or Pamela Dolan, (212) 689-4220; 
fax (212) 689-4348; 75017.2143@compuserve.com; 
www.reedmidem.milia.com. 

February 9-12 - DEMO '97 - Indian Wells, CA. Sponsored by Apple Computer, 
AT&T, Gemini Management Consulting and HP. Now it’s Chris 
Shipley’s picks. Call (800) 633-4312; fax (415) 286-2750; 
conference registrar@infoworld.com; 
www.conferences.infoworld.com. 

February 12-15 Interactive Newspapers - Houston. Organized by Editor and 
Publisher. Discuss how newspapers will keep those ads and 
classifieds coming. Call Marsha Stoltman, (212) 675-4380 ext. 
502; fax (212) 929-1894. 


Release 1.0 24 December 1996 


28 


February 19-21 


February 19-22 


February 22-26 


February 26-28 


March 1-5 


March 9-12 


March 11-14 


March 18-20 


March 20-21 


March 23-26 


April 6-9 


Hay 18-20 


May 19-21 


May 27-29 
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*Internet & Politics - Munich, Germany. How do they interact? 
Sponsored by the Academy for the Third Millennium and Burda 
Holdings. Contact: Christa Maar, 49 (80) 9250-3559, fax 9250- 
3464, 100431.3372@compuserve.com. 

TED? - Monterey, CA. Organized by TEDConferences and the in- 
imitable Richard Saul Wurman. With Edward DeBono, John Seely 
Brown and Michael Kinsley. Call Richard Saul Wurman, (401) 
848-2299; fax (401) 848-2599; wurmanrs@aol.com; www.ted.com. 
Web Design and Development West "97 - San Francisco. Sup- 
ported by Sun, Intel, Spyglass and others. Call (800) 441- 
8826; fax (415) 905-2222; web97@mfi.com; www.web97.com. 
Internet Expo - Zurich. Sponsored by Compress Information 
Group. Call 41 (6) 1 722 77 00; fax 41 (6) 1 77 22 OL; 
info@compress.ch; www.iex.ch. 

VBAIS °97 (Virtual Reality Annual International Symposium) - 
Albuquerque, NM. Sponsored by IEEE. Calling for papers now. 
Call Larry Hodges, (404) 894-8787; fax (404) 894-0673; 
hodges@cc.gatech.edu; www.eece.unm.edu/eece/conf/vrais. 
Support Services East - Nashville. Sponsored by Softbank Ex- 
pos. Network, network, network! Call (800) 801-1354; fax 
(719) 528-4252; csc@sbexpos.com; www.SBExpos.com/ssce. 

*CFP °97: Commerce & Communities - Burlingame, CA. Hosted by 
ACM, Stanford, and UC Berkeley. Seventh conference on com- 
puters, freedom and privacy. Send inquiries and suggestions 
for conference content to cfp97@cfp.org. 

Internet & Electronic Commerce - New York City. Sponsored by 
Gartner Group and Expocon. Gall Paul Sitar, (203) 256-4700 
ext. 115; fax, (203) 256-4730; psitar@expocon.com; 

www. expocon. com. 

Winlab Workshop - New Brunswick, NJ. Sponsored by the Rutgers 
Wireless Network Laboratory. Call Noreen DeCarlo, (908) 445- 
5954; fax (908) 445-3693; noreend@winlab.rutgers.edu; 

http: //winwww.rutgers.edu. 

**@QPC (Platforms for Communication) Forum - Tucson, AZ. The 
twentieth annual; sponsored by us. "The living web: models 
and metaphors." You read the newsletter; now meet the 
players. Gall Forum Director Daphne Kis, (212) 924-8800; fax 
(212) 924-0240; daphne@edventure.com; www.edventure.com. 
Software Marketing Perspectives °97 - San Francisco. Hosted 
by Software Marketing Journal. Expand your horizons; develop 
new strategies. Call the Conference Hotline, (415) 546-5585; 
fax (415) 546-5599; smp@softwaremarketing.com. 

Localization Conference - Monterey, CA. Sponsored by Henes 
Associates. Mind-melding for localization and international 
product managers. Call Ulrich Henes, (608) 233-3380; fax 
(608) 233-3511; Ulrich.Henes@Msn.fullfeed.com. 

Executive Technology Summit '97 - Phoenix. Hosted by SIM and 
Computerworld. For CIOs and senior-level IT execs looking for 
timely and accurate information about the distributed enter- 
prise. Call Carrol-lynne Klein, (800) 464-0061 ext. 1741; 
fax (312) 494-3015; www.simnet.org. 

Internet World Berlin °97 - Berlin. Sponsored by Meck- 
lermedia. Contact Cecilia, cecilia@mecklermedia.com; 
www.iworld.com. 
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May 27-30 Tenth Annual International Software Quality Week - San Fran- 
cisco. Sponsored by the Software Research Institute. Call 
Margaret Kenney, (800) 942-7638 or (415) 957-1441; fax (415) 
957-0730; kenney@soft.com; www.soft.com/QualWeek. 

June 9-14 Asia TELECOM "97 - Singapore. Sponsored by ITU. Contact Tom 
Dahl-Hansen, 41 (22) 730 5298; fax 41 (22) 730 6444; dahl- 
hansen@itu.ch; www3.itu.ch/TELECOM/ast97/. 

June 15-18 Global Networking °97 - Calgary, Alberta, Canada. Sponsored 
by Telus. Call Pete Desrochers, (403) 493-4760; fax (403) 
493-5380; pdesrocl@ent.agt.ab.ca; www.wnet.ca/gn97/; 
www.wnet.ca/qn97/. 

Sept 8-14 Telecom Interactive - Geneva. Sponsored by ITU. Contact 
Fernando A. Lagrana, 41 (22) 730 5542/5179; fax 41 (22) 730 
6444; fernando. lagrana@itu.int; www.itu.ch/TELECOM. 


* Events Esther plans to attend. 
@ Events Jerry plans to attend. 


Lack of a symbol is no indication of lack of merit. 
The full, current calendar is available on our Website (www.edventure.com). 
Please let us know about other events we should include. -- Susanna Stromberg 


Release 1.0 is published monthly, except for a combined July/August issue, 
by EDventure Holdings, 104 Fifth Ave., New York, NY 10011-6901; (212) 924- 
8800; fax, (212) 924-0240. It covers PCs, software, the Internet, computer- 
telephone integration, online services, groupware, text management, connec- 
tivity, messaging, wireless communications, intellectual property law and 
other unpredictable topics. Editor: Esther Dyson (edyson@edventure.com) ; 
publisher: Daphne Kis (daphne@edventure.com); managing editor: Jerry 
Michalski (spiff@edventure.com); circulation & fulfillment manager: Robyn 
Sturm (robyn@edventure.com); assistant circulation & fulfillment manager: 
Scott Giering (scott@edventure.com); administrative assistant: Susanna 
Stromberg (susanna@edventure.com); executive assistant: Helen Martin 
(helen@edventure.com); editorial & marketing communications consultant: 
William M. Kutik- (kutik@edventure.com). Copyright 1996, EDventure Holdings 
Inc. All rights reserved. No material in this publication may be reproduc- 
ed without written permission; however, we gladly arrange for reprints or 
bulk purchases. Subscriptions cost $595 per year, $650 overseas. 
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SUBSCRIPTION FORM 


Please enter my subscription to Release 1.0 at the rate of $595 per year in the 
U.S. and Canada. Overseas subscriptions are $650, airmail postage included. Payment 
must be enclosed. Satisfaction guaranteed or your money back. 


Name 


Title 


Company 


Address 


City State Zip 


Country 


Telephone Fax 


E-mail URL 


CI Check enclosed. 
{Charge my 
l American Express M Mastercard kd Visa 


Card Number Expiration Date 


Name on Card Signature 


{J Please send me information on your multiple-copy rate. 


Lb IB 19.96 


Please fill in the information above and send to: 


EDVENTURE HOLDINGS INC. 
104 FIFTH AVENUE, 20TH FLOOR 
New York, NY 10011 


If you have any questions, please contact us at 1 (212) 924-8800; 
fax 1 (212) 924-0240; e-mail us@edventure.com; www.edventure.com. 
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